Sauna easy windows ✓ ▶ Credentials in the registry and history (user) AS-REP roasting Password spraying and valid users Remote execution (WinRM, PsExec, WMI) Hash cracking Credentials in the registry and history ACL abuse (BloodHound) DCSync Pass-the-hash / ticket
Timelapse easy windows ✓ ▶ Credentials in the registry and history (user) SMB/NFS enumeration Remote execution (WinRM, PsExec, WMI) Hash cracking Backups and archives Credentials in the registry and history Reading LAPS passwords
Bart medium windows ✓ ▶ Credentials in the registry and history (root) Vhost and subdomain fuzzing LFI / path traversal Log analysis Credentials in the registry and history Hash cracking
Cascade medium windows ✓ ▶ Credentials in the registry and history (user) Domain LDAP/RPC enumeration SMB/NFS enumeration Credentials in the registry and history Remote execution (WinRM, PsExec, WMI) Weak or homemade cryptography Privileged Windows groups Deleted AD objects Reverse engineering
Chatterbox medium windows ✓ ▶ Credentials in the registry and history (root) Public CVE exploitation Stack buffer overflow Credentials in the registry and history Password reuse
Resolute medium windows ✓ ▶ Credentials in the registry and history (user) Domain LDAP/RPC enumeration Password spraying and valid users Remote execution (WinRM, PsExec, WMI) Credentials in the registry and history Privileged Windows groups
SecNotes medium windows ✓ ▶ Credentials in the registry and history (root) SMB/NFS enumeration CSRF Malicious file upload SQL injection Credentials in the registry and history
Analysis hard windows ✓ ▶ Credentials in the registry and history (user) Directory brute forcing Vhost and subdomain fuzzing LDAP injection Malicious file upload Credentials in the registry and history Log analysis DLL hijacking
Axlle hard windows ✓ ▶ Credentials in the registry and history (user) Phishing and malicious documents Credentials in the registry and history ACL abuse (BloodHound) Scheduled tasks and admin scripts
Breadcrumbs hard windows ✓ ▶ Credentials in the registry and history (user) JWT attacks LFI / path traversal Malicious file upload AV and EDR evasion Cookie or session forging Credentials in the registry and history Credentials in files SQL injection Internal services and port forwarding Reverse engineering Weak or homemade cryptography
Control hard windows ✓ ▶ Credentials in the registry and history (user) Directory brute forcing Authentication bypass SQL injection AV and EDR evasion Credentials in the registry and history Hash cracking Misconfigured services
Reel2 hard windows ✓ ▶ Credentials in the registry and history (user) Phishing and malicious documents NTLM capture and relay Password spraying and valid users Hash cracking Credentials in the registry and history Remote execution (WinRM, PsExec, WMI) AppLocker and Constrained Language Mode LFI / path traversal
APT insane windows ✓ ▶ Credentials in the registry and history (user) SMB/NFS enumeration Pass-the-hash / ticket Password spraying and valid users SAM/LSA/LSASS dumping Backups and archives Credentials in the registry and history AV and EDR evasion NTLM capture and relay Hash cracking
Bighead insane windows ✓ ▶ Credentials in the registry and history (user) Vhost and subdomain fuzzing Stack buffer overflow Credentials in the registry and history Internal services and port forwarding LFI / path traversal Hash cracking